Code of Ethical Conduct.

1. Purpose of this Code

This Code is the mandatory reference for the conduct of all employees, owners, officers, managers, board members, interns, and young apprentices (Employees), and it also guides suppliers and business partners, enabling ethical behavior and actions that reflect the values embraced by EPIC DIGITAL. Accordingly, the main objectives of this Code are to:

• Present the fundamental ethical guidelines practiced by the Employees bound by this document;
• Declare the adherence of all Employees to the ethical principles and values and the corporate morality set out in this Code;
• Establish the relationship with clients, public bodies, authorities, and society in general;
• Ensure moral behavior as a practice in the corporate environment;
• Set out the disciplinary penalties and, where applicable, the legal proceedings to which offending Employees will be subject.

2. General Principles, Vision, and Values

Everyone to whom this Code applies must fulfill the duties and observe the ethical standards prescribed herein and, in particular, the guiding principles of:

• Impersonality; Morality; Honesty; Impartiality; Loyalty; Transparency;
• Confidentiality and Personal Data Protection;
• Mutual cooperation; Security; Responsibility; Socio-environmental; Initiative.

The vision of EPIC DIGITAL is to add value to the client's business, pursuing growth through digital marketing and HubSpot technology solutions.

To that end, the following values must be part of the daily routine and conduct of Employees:

• Integrity: being ethical and not tolerating corruption or illegality;
• Respect for people: seeing human beings as the most valuable asset there is;
• Respect for the environment: acting in favor of sustainability;
• Resilience and innovation.

3. Harassment and Other Practices Not Tolerated

EPIC DIGITAL rejects discrimination, racism, bribery, extortion, corruption, and the payment of kickbacks, in all their forms, inside or outside our companies.

EPIC DIGITAL does not allow harassment, whether sexual, moral (psychological), or of any other nature, nor situations that amount to intimidation or threats in relationships between Employees, regardless of hierarchical level.

Harassment occurs when someone in a privileged position uses that advantage to humiliate, coerce, embarrass, or induce others into acts or omissions that amount to inappropriate behavior.

This type of practice will subject the Employee to the measures set out in this Code and in other potentially applicable rules, including criminal law.

4. Professional Conduct

All Employees are required to meet the following standards of professional conduct:

• Act with integrity, competence, dignity, and ethics when dealing with the public, clients, government entities, authorities, colleagues, and Employees;
• Act, and encourage colleagues, clients, government entities, and other authorities to act, professionally and ethically, in a way that ensures the credibility of EPIC DIGITAL;
• Seek to maintain and raise their technical competence and contribute to the training of everyone in the company, striving for the best results;
• Base their professional behavior on impartial judgment and on restraint in their public statements;
• Refrain from making, on behalf of EPIC DIGITAL, any contribution in money, goods, or services to political campaigns or causes;
• Treat everyone courteously, without prejudice based on origin, race, sex, color, age, sexual orientation, social or economic status, or religion, avoiding and reporting any form of discrimination;
• Resist any pressure and intimidation from beneficiaries, interested parties, and others seeking to obtain favors or undue advantages through immoral, illegal, and unethical actions;
• Deal with clients, government entities, and authorities in a strictly professional manner, preserving the impartiality required to perform their duties;
• Maintain absolute confidentiality about the operations, as well as about information not yet made public, of their clients, government entities, service providers, and suppliers that they learn of through their professional activities;
• Not offer or accept any undue advantage arising, directly or indirectly, from the activities performed at EPIC DIGITAL;
• Always perform their activities with respect for personal data protection, following the rules and parameters defined in this Code, in training, and in related policies, especially the information security and personal data protection policy;
• Report any and all conduct or omission that could potentially constitute a violation of this Code or of any other rule or guiding principle of EPIC DIGITAL.

5. Conflicts of Interest

A conflict of interest occurs when an Employee uses influence or commits acts intended to obtain private benefits for themselves or for third parties, which may in any way influence or steer standards of conduct for their own benefit or that of third parties, and which may cause damage or losses or be contrary to the interests of EPIC DIGITAL and its clients.

Employees and other persons whose services involve dealings on behalf of any EPIC DIGITAL company, as well as its owners and board members, may not carry out outside activities, provide consulting services, or hold positions in organizations whose interests conflict with those of EPIC DIGITAL.

Ownership interests, whether held directly or through a spouse or family members as defined below, in companies that compete directly with EPIC DIGITAL are also not accepted if the Employee's position confers the power to influence transactions or allows access to privileged information, or if the interest benefits the Employee, spouse, or family member.

Employees who perform additional activities at other companies (holding positions in outside entities) and/or who have a spouse or family members working at competitors or business partners must immediately notify their supervisor in writing. The supervisor will assess any conflicts of interest and any overlap with working hours, so that the Employee's work at EPIC DIGITAL is not impaired.

Family members by blood up to the second degree are: parents, children, grandparents, and siblings. For the purposes of this Code, relatives by marriage up to the second degree are also included, namely: spouse, domestic partner, son-in-law, daughter-in-law, father-in-law or mother-in-law, stepfather, stepmother, and stepchild.

5.1 Supplier conflicts of interest

• Suppliers may at times face situations that involve a conflict of interest. This occurs whenever the work of the supplier, or of anyone linked to the supplier, may be compromised because it provides or has provided services to third parties that may have any kind of interest in the results of the services provided to EPIC DIGITAL, influencing or in any way compromising, even potentially, decisions or prices, or in any way negatively affecting the provision of services to EPIC DIGITAL.
• In addition, suppliers may not provide services when there is a family relationship between those involved in the services and any Employee, shareholder, or board member of the company, where that relationship may in any way involve a potential conflict of interest.
• Managers and other Employees involved in hiring suppliers must adopt practices capable of ensuring that all contracted suppliers comply with these conditions.

5.2 Conflicts of interest arising from relationships between Employees

• As a rule, EPIC DIGITAL does not prohibit romantic relationships between its Employees, owners, and board members. However, any romantic relationship is prohibited whenever there is a hierarchical relationship between those involved and whenever such relationship may lead to behavior that could in any way benefit one of those involved or compromise the impartiality and impersonality required in corporate conduct. The same rule applies to any family relationship between Employees.
• Any romantic relationship that may conflict with the provisions of this Code must be disclosed to the human resources department, which will assess any conflict of interest, it being understood that the matter may be referred to the Compliance Committee for review and final decision.

6. Use of Email and Professional Communication Tools

In addition to the provisions of the existing EPIC DIGITAL Information Security Policy, the use of email and other official communication tools is also governed by this Code and must be limited to strictly professional matters. Such communications must use formal language, and slang, profanity, or any other term that could harm the institutional image of EPIC DIGITAL and a good work environment is prohibited.

Electronic systems and IT resources are available to Employees for the proper performance of their duties.

Use of EPIC DIGITAL electronic systems and IT resources for personal matters is not authorized.

Passwords for access to systems and email are for personal use and are the sole responsibility of the Employee, and they may not be shared with third parties, even with a coworker.

No software or programs of any kind may be copied or installed on EPIC DIGITAL computers and other devices without prior authorization from the Information Technology department. Installing unlicensed software, viruses, malware, Trojans, or similar devices may subject the Employee to administrative sanctions.

Access to email and any other communication tools outside working hours by Employees who do not hold a position of trust will occur only with prior authorization from the department manager.

7. Use of Equipment and Any Other Assets or Resources

All materials provided by EPIC DIGITAL are the property of EPIC DIGITAL and must remain on company premises unless a supervisor authorizes their removal from the workplace.

When using any EPIC DIGITAL equipment, asset, or resource, Employees must always exercise the same care, diligence, and attention they give to their own belongings.

Loss, unusual deterioration, or theft of the resources provided must be reported immediately, it being understood that, where the Employee is solely at fault, the Employee will reimburse the costs related to that resource.

All email, websites, or any other means of communication used by Employees for professional purposes are the property and right of EPIC DIGITAL and may therefore be constantly monitored, especially communications made from EPIC DIGITAL equipment.

Employees are prohibited from attempting to access, or accessing, without the presence or supervision of a manager, any logical network or cloud environment that is not related to the performance of their activities.

Access to and use of any assets must follow the procedures and processes set out in the Information Security Policy.

8. Relations with the Press and Other Media

The media are an important source of information for the various segments of society. Therefore, whenever possible, and where there are no legal or strategic obstacles, EPIC DIGITAL will remain accessible and available to provide data and clarifications.

Only expressly authorized Employees are permitted to speak with the media on behalf of EPIC DIGITAL.

Under no circumstances may anyone make any statement to the press in general that could be interpreted as discriminatory on the grounds of origin, ethnicity, religion, social class, sex, or sexual orientation, among other reasons. The use of expressions inconsistent with good manners is also prohibited. This item also includes the prohibition on making statements to the media that may appear to have, or that have, a party-political orientation or an ideological character of any kind.

If an EPIC DIGITAL Employee is authorized to take part in interviews or similar activities, they must always consult the legal department or their supervisor and limit themselves to strictly technical, accurate, and complete comments based on facts, avoiding unnecessary value judgments. In addition, statements must use precise terminology and avoid disclosing sensitive, controversial, or inaccurate information.

EPIC DIGITAL does not authorize, except where expressly permitted, the use of social media for any professional statement by a company Employee.

9. Confidentiality and Data Protection

Employees must conduct all their professional activities with confidentiality, undertaking to share with third parties and others only the information that is strictly necessary and related to the business concerning each of them. The following information is also considered confidential:

• Information related to any financial transactions or any business conducted by EPIC DIGITAL;
• Information originating from the market, clients, or third parties and obtained as a result of the relationship between the Employee and EPIC DIGITAL;
• Any personal data, including data of prospects, Employees, clients, suppliers, and third parties;
• Other information that, due to the nature of the data transmitted, should be considered confidential. Note that disclosing confidential or privileged information is a crime and also gives rise to civil liability.

Unauthorized reproduction and transfer, in any form, of any confidential content will be considered gross misconduct when not grounded in the strict duties delegated to the Employee.

The departure of an Employee will require the immediate transfer of all content held by that Employee, including any personal data, to the head of the Human Resources department. Departure also does not release the Employee from their confidentiality obligations, which will remain in effect.

Every engagement of a supplier that processes personal data will require prior due care by Employees, from the requesting Employee to the Purchasing department, to ensure best practices in the processing of personal data, especially under the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018) and related regulations.

Employees must ensure that EPIC DIGITAL products and services are designed and operate in accordance with privacy by design best practices.

10. Relations with Authorities and Government Bodies

Only expressly authorized Employees may send information to, and respond to other requests from, authorities and government bodies, which include any company directly or indirectly controlled by the public administration.

Accordingly, any participation in any public tender or similar activity, the relationship arising from any contract, and any relationship activity or activity arising from information required by such entities will be handled only by authorized persons, and any meetings or other negotiations will preferably take place with at least two authorized Employees present.

Offering any consideration or advantage to authorities and any government entities is expressly prohibited, whether in dealings for the contracting of EPIC DIGITAL products or services or in any other kind of relationship. Employees who deal with such entities must take periodic, recurring anti-corruption training.

All Employees are encouraged to bring to EPIC DIGITAL any offer, even if implicit, of a request for or suggestion of a bribe or any other type of advantage that could lead to legally undue benefits. Such matters must be referred to the Compliance Committee to determine the appropriate legal measures.

No Employee may engage in or hold any political role or office, and the Employee is obligated to disclose any intention to seek any office or position and to request the corresponding separation from EPIC DIGITAL.

No affiliation or other political connection of an Employee may have any direct or indirect relationship with EPIC DIGITAL.

11. Relations with Clients

All our clients motivate EPIC DIGITAL to keep updating and developing constantly, seeking process improvements, innovative tools, and new technologies in order to deliver our services with excellence. It is with our clients in mind that our teams dedicate themselves every day. EPIC DIGITAL wants to strengthen our relationship of credibility and to contribute in some way to the success of our clients.

Relationships with clients may not involve the payment of any consideration or other benefit to client professionals and/or their family members.

12. EPIC DIGITAL Intellectual Property

The models, internal routines, databases, and analysis systems that have been developed, are under development, or may be created in the course of work, including by Employees in the performance of their duties, are the exclusive intellectual property of EPIC DIGITAL, and the officers are responsible for deciding on their commercialization, reproduction, or use, always within the limits of the articles of association or other corporate documents of EPIC DIGITAL.

Copying, selling, using, or distributing information, analysis spreadsheets, internal reports, and other materials that support EPIC DIGITAL decision-making is prohibited without the prior written consent of a person expressly authorized to give it.

All programs, facilities, projects, products, or any other elements that may be legally protected or commercialized, jointly or separately, belong to EPIC DIGITAL, even if the asset was produced by an Employee, who is not entitled to any ownership, compensation, or share in the results arising from the asset.

13. Compliance Committee

EPIC DIGITAL has a Compliance Committee, which is responsible for continuously assessing whether this Code is current and relevant, and for determining the actions needed to communicate and spread the highest standards of ethical conduct within the company.

The Committee is also responsible for judging the most serious cases of violation and applying the appropriate sanctions for breaches of the Code.

The Committee will consist of the CEO of EPIC DIGITAL, a legal member, and a human resources member, and it is responsible for reviewing cases of violation of this Code through the email address that serves as the communication channel with the Committee, which has a legal and contractual obligation to maintain full confidentiality regarding the sender of any message received: compliance@epic.digital

Anyone who, for any reason, believes that a Committee member may be involved in the report or may in any way have a conflict of interest in their role may send the report separately to any other Committee member, and contact details will be available on all relevant communication channels with Employees.

Anyone reviewing a report must keep any and all information in absolute confidentiality, will act autonomously and independently, and will have the following main duties:

• Communicate and promote all the ethical principles of this Code;
• Ensure effective compliance with the ethical principles and other rules established in this Code;
• Work to clarify possible questions about specific cases and about the interpretation of this Code;
• Encourage and receive suggestions for improvements and updates to the rules of this Code and other policies in use;
• Receive and conclusively investigate reports of suspected misconduct or behavior contrary to the rules of this Code;
• Make reporting channels available and publicize them;
• Dispel and prevent fear on the part of the harassed person and the whistleblower arising from a report;
• Apply, or recommend the application of, legal and internal penalties arising from practices that breach this Code or any policies, and apply to the person responsible for harassment the disciplinary penalty corresponding to the seriousness of their conduct, observing the principles of moderation and proportionality;
• Attempt mediation between the parties to the harassment for an amicable resolution of the conflict, when possible.

Every whistleblower is assured that no retaliation or repressive measure will be taken as a result of their report, even if it is unfounded.

Conversely, knowingly and intentionally false reports will be investigated and punished under the terms and measures of the law.

EPIC DIGITAL has a Reporting Channel set up exclusively to review cases of breach of this Code. Cases should be sent to: denuncia@epic.digital or through the form available on our websites. Identification is optional. Cases will be reviewed with full data privacy, in accordance with this Code.

14. Compliance with the Code of Ethical Conduct, Updates, and Training

EPIC DIGITAL expects everyone to whom this Code applies to adopt ethical conduct consistent with the values and beliefs of the company and to be responsible for full compliance with it.

Demonstrably false accusations or information about misconduct are unacceptable and will subject the person responsible to the disciplinary measures provided for by law and by company rules.

Breaches of this Code will be reviewed case by case and, depending on the consequences of the practice, may even be considered gross misconduct by the Employee under applicable law.

This Code will be reviewed and updated whenever necessary and will undergo a mandatory review at least every 12 (twelve) months.

All new Employees must be trained on compliance with this Code, and all Group Employees must receive annual training on at least ethics, anti-corruption, information security, and harassment.

15. Prohibition of Child Labor and Slave Labor

EPIC DIGITAL suppresses and does not tolerate any practice that may involve child labor. For the purposes of this Code, child labor is any form of work performed by children and adolescents, except as young apprentices under the law.

Likewise, EPIC DIGITAL does not engage in relationships considered analogous to slavery, such as:

• subjecting workers to work demanded under threat of punishment, through coercion, and performed involuntarily;
• restricting the worker's use of any means of transportation in order to keep them at the workplace because of a debt owed to the employer or its agent, resulting in geographic isolation;
• maintaining armed security in order to keep the worker at the workplace because of a debt owed to the employer or its agent;
• withholding the worker's personal documents in order to keep the worker at the workplace;

Likewise, partners and suppliers must combat such practices, and Employees are responsible for adopting practices that regulate these requirements and make it possible to hold violators accountable.

16. Sanctions

Any act or conduct contrary to the values and principles underlying this Code, or that breaches the guidelines established herein, will not be tolerated, and violators will be subject to the applicable disciplinary sanctions provided for in the Consolidação das Leis do Trabalho (Brazilian Consolidated Labor Laws), always starting with a warning.

Repeat offenses and failure to comply with the action plans set after proper guidance may lead to more severe measures, up to and including the Employee's dismissal. The attitude of the Compliance Committee toward the violator must be fair, reasonable, and proportionate to the misconduct committed.